Skip to content

fix: improve DCR consistency and safety#82

Merged
telegrapher merged 33 commits intomainfrom
fix/dcr-consistency
Mar 2, 2026
Merged

fix: improve DCR consistency and safety#82
telegrapher merged 33 commits intomainfrom
fix/dcr-consistency

Conversation

@telegrapher
Copy link
Collaborator

Summary

  • Fix JSON injection vulnerability in DCR payload construction — replaced manual string concatenation with json.Marshal for proper escaping of client names and redirect URIs.
  • Use httpClient() instead of http.DefaultClient so proxy, TLS, and timeout settings apply to DCR requests.
  • Simplify Register() return type from RegisterResponse{StatusCode, Body} to (string, error), matching all other commands in the package.
  • Add URL validation via validateURL() to DCR config validation.
  • Fix error wrapping (%v%w) across DCR files for proper error chain propagation.
  • Add missing Apache 2.0 license headers to ims/register.go, ims/client.go, and cmd/dcr.go.
  • Output pretty-printed JSON instead of raw body + status code, consistent with other commands.

telegrapher and others added 21 commits February 28, 2026 16:45
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
The *.json gitignore rule was preventing these from being tracked. Generated from the JSON() function output to match TestJSON expectations.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Replace nonexistent login command with authorize, fix IMS_ suffix to prefix, remove ghost completion section, add missing commands (pkce, client, decode, refresh, admin, dcr), fix grammar and heading consistency.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Add CI, Codecov, pkg.go.dev, and license badges. Replace verbose intro with tagline. Add quick start examples, full commands table, global flags table, and configuration summary.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…uting guide

Add Development section with build/test/vet commands. Document all CI pipelines (ci, pr-title, release, codeql) with triggers. Document repo settings (squash merge, auto-delete). Fix gorelease typo and --rm-dist flag.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
CI workflow runs test (with coverage upload to Codecov), lint (go vet + golangci-lint v2), and build jobs on every push and PR to main. PR title workflow enforces conventional commit format on PR titles to support squash-merge changelog generation.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Remove boilerplate comments and add meaningful ones explaining each step. Switch from hardcoded go-version to go-version-file for automatic sync. Add conventional commit changelog grouping (Features, Bug Fixes, Other) and exclude ci/chore prefixes.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Explicitly discard error returns from fmt.Fprintln in HTTP handlers (connection already dead if write fails), listener.Close and res.Body.Close in deferred calls (nothing actionable on failure).

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
PKCE is mandatory for public clients but optional (recommended) for private clients in IMS. The previous docs implied PKCE was only for public clients.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Codecov requires admin access to install the GitHub App. Replace with a go tool cover summary printed to the CI log. Remove the Codecov badge from README.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
telegrapher and others added 8 commits February 28, 2026 18:06
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
telegrapher and others added 2 commits February 28, 2026 18:35
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Base automatically changed from chore/docs-ci-improvements to main March 2, 2026 09:59
@telegrapher telegrapher merged commit 7d90a8c into main Mar 2, 2026
14 checks passed
@telegrapher telegrapher deleted the fix/dcr-consistency branch March 2, 2026 10:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants